The session timeout setting can be defined in two places. You can define it in the code directly, but commonly it is defined in the properties of IIS on the server.
The reasons the session will clear, other than timeout are, if the browser closes, or if you give a session.abandon command. That will force the session object to die. The money's gone, the brain is shot.....but the liquor we still got.